# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# instantiate Tasks objecttasks=tc.tasks()owner='Example Community'task_id=123456# set a filter to retrieve only the Task with ID: 123456filter1=tasks.add_filter()filter1.add_owner(owner)filter1.add_id(task_id)try:# retrieve the Tasktasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)try:# prove there is only one Task retrievedassertlen(tasks)==1exceptAssertionErrorase:# if the Task doesn't exist in the given owner, raise an errorprint('AssertionError: The task with id {0} was not found in the "{1}" owner. '.format(task_id,owner)+'Try changing the `owner` variable to the name of an owner in your instance of ThreatConnect '+'and/or set the `task_id` variable to the ID of a task that exists in the given owner.')sys.exit(1)# iterate through the retrieved Task (in this case there should only be one) and print its propertiesfortaskintasks:print(task.id)print(task.name)print(task.date_added)print(task.weblink)print('')

Note

If you get an AssertionError when running this code, you likely need to change the name of the owner variable so that it is the name of an owner in your instance of ThreatConnect and/or you need to change the task_id variable so that it is the ID of a Task that exists in the given owner.

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# instantiate Tasks objecttasks=tc.tasks()# set a filter to retrieve only Tasks with the tag: "Nation State"filter1=tasks.add_filter()filter1.add_tag('Nation State')try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))# iterate through the retrieved Tasks and print their propertiesfortaskintasks:print(task.id)print(task.name)print(task.date_added)print(task.weblink)print('')

The example below demonstrates how to update a Task Resource in the ThreatConnect platform:

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# instantiate Tasks objecttasks=tc.tasks()# create a new Task object with an updated nametask=tasks.add('Updated Task')# set the ID of the new Task to the ID of the existing Task you want to updatetask.set_id(123456)# you can update the Task metadata as described here: https://docs.threatconnect.com/en/latest/python/python_sdk.html#group-metadatatry:# update the Tasktask.commit()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)

Note

In the prior example, no API calls are made until the commit() method is invoked.

The example below demonstrates how to delete a Task Resource from the ThreatConnect platform:

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# instantiate Tasks objecttasks=tc.tasks()owner='Example Community'# create an empty Tasktask=tasks.add('',owner)# set the ID of the new Task to the ID of the Task you would like to deletetask.set_id(123456)try:# delete the Tasktask.delete()exceptRuntimeErrorase:print(e)sys.exit(1)

Note

In the prior example, no API calls are made until the delete() method is invoked.

The code snippet below demonstrates how to view Groups, Indicators, and Victims which are associated with a given Task in ThreatConnect. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# instantiate Tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasks and print their associationsfortaskintasks:print(task.name)# iterate through all associated groupsforassociated_groupintask.group_associations:# print details about the associated groupprint(associated_group.id)print(associated_group.name)print(associated_group.resource_type)print(associated_group.owner_name)print(associated_group.date_added)print(associated_group.weblink)print('')# iterate through all associated indicatorsforassociated_indicatorintask.indicator_associations:# print details about the associated indicatorprint(associated_indicator.id)print(associated_indicator.indicator)print(associated_indicator.type)print(associated_indicator.description)print(associated_indicator.owner_name)print(associated_indicator.rating)print(associated_indicator.confidence)print(associated_indicator.date_added)print(associated_indicator.last_modified)print(associated_indicator.weblink)print('')# iterate through all associated victimsforassociated_victimintask.victim_associations:# print details about the associated victimprint(associated_victim.id)print(associated_victim.name)print(associated_victim.description)print(associated_victim.owner_name)print(associated_victim.nationality)print(associated_victim.org)print(associated_victim.suborg)print(associated_victim.work_location)print(associated_victim.weblink)print('')

Note

When the group_associations, indicator_associations, and victim_associations methods are called, an API request is invoked immediately.

The code snippet below demonstrates how to create an association between a Task and another Group, Indicator, and Victim in ThreatConnect. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

fromthreatconnect.Config.ResourceTypeimportResourceType# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# instantiate Tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasksfortaskintasks:print(task.name)# create an association between this task and the incident with the ID: 654321task.associate_group(ResourceType.INCIDENTS,654321)# create an association between this task and the URL indicator: http://example.com/task.associate_indicator(ResourceType.URLS,'http://example.com/')# create an association between this task and the victim with the ID: 333333task.associate_victim(333333)# commit the changes to ThreatConnecttask.commit()

Note

In the prior example, no API calls are made until the commit() method is invoked.

The code snippet below demonstrates how to remove an association between a Task and another Group, Indicator, and Victim. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

fromthreatconnect.Config.ResourceTypeimportResourceType# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# instantiate Tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasksfortaskintasks:print(task.name)# remove the association between this task and the incident with the ID: 654321task.disassociate_group(ResourceType.INCIDENTS,654321)# remove the association between this task and the URL indicator: http://example.com/task.disassociate_indicator(ResourceType.URLS,'http://example.com/')# remove the association between this task and the victim with the ID: 333333task.disassociate_victim(333333)# commit the changes to ThreatConnecttask.commit()

Note

In the prior example, no API calls are made until the commit() method is invoked.

The code snippet below demonstrates how to retrieve the attributes from a Task. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# create a tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasksfortaskintasks:print(task.name)# load the task's attributestask.load_attributes()forattributeintask.attributes:print(attribute.id)print(attribute.type)print(attribute.value)print(attribute.date_added)print(attribute.last_modified)print(attribute.displayed)print('')

The code snippet below demonstrates how to create an attribute on a Task. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# create a tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasksfortaskintasks:print(task.name)# add a description attribute that is displayed at the top of the task's page in ThreatConnecttask.add_attribute('Description','Description Example',True)# add a description attribute that is not displayed at the top of the task's page in ThreatConnecttask.add_attribute('Description','Description Example')# commit the changestask.commit()

Note

In the prior example, no API calls are made until the commit() method is invoked.

The code snippet below demonstrates how to update a Task’s attribute. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# create a tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasksfortaskintasks:print(task.name)# load the task's attributestask.load_attributes()# iterate through the task's attributesforattributeintask.attributes:print(attribute.id)# if the current attribute is a description attribute, update the value of the descriptionifattribute.type=='Description':task.update_attribute(attribute.id,'Updated Description')# commit the changestask.commit()

Note

In the prior example, no API calls are made until the commit() method is invoked.

The code snippet below demonstrates how to delete a Task’s attribute. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# create a tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasksfortaskintasks:print(task.name)# load the task's attributestask.load_attributes()# iterate through the task's attributesforattributeintask.attributes:print(attribute.id)# if the current attribute is a description attribute, delete itifattribute.type=='Description':task.delete_attribute(attribute.id)# commit the changestask.commit()

Note

In the prior example, no API calls are made until the commit() method is invoked.

The code snippet below demonstrates how to retrieve the security label from a Task. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# create a tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasksfortaskintasks:print(task.name)# load the task's security labeltask.load_security_label()# if this task has a security label, print some information about the sec. labeliftask.security_labelisnotNone:print(task.security_label.name)print(task.security_label.description)print(task.security_label.date_added)print('')

Warning

Currently, the ThreatConnect Python SDK does not support multiple security labels. If a Task has multiple security labels, the Python SDK will only return one of them.

The code snippet below demonstrates how to add a security label to a Task. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# create a tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasksfortaskintasks:print(task.name)# add the 'TLP Green' label to the tasktask.add_security_label('TLP Green')# commit the task with the new security label to ThreatConnecttask.commit()

Note

In the prior example, no API calls are made until the commit() method is invoked.

The code snippet below demonstrates how to delete a security label from a Task. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# create a tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasksfortaskintasks:print(task.name)# remove the 'TLP Green' label from the tasktask.delete_security_label('TLP Green')# commit the task with the removed security label to ThreatConnecttask.commit()

Note

In the prior example, no API calls are made until the commit() method is invoked.

The code snippet below demonstrates how to retrieve the tags from a Task. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# create a tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasksfortaskintasks:print(task.name)# load the task's tagstask.load_tags()# print details about each tag on the taskfortagintask.tags:print(tag.name)print(tag.weblink)print('')

The code snippet below demonstrates how to add a tag to a Task. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# create a tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasksfortaskintasks:print(task.name)# add the 'Test' tag to the tasktask.add_tag('Test')# commit the task with the new tag to ThreatConnecttask.commit()

Note

In the prior example, no API calls are made until the commit() method is invoked.

The code snippet below demonstrates how to delete a tag from a Task. This example assumes there is a Task with an ID of 123456 in the target owner. To test this code snippet, change the task_id variable to the ID of a task in your owner.

# replace the line below with the standard, TC script heading described here:# https://docs.threatconnect.com/en/latest/python/quick_start.html#standard-script-heading...tc=ThreatConnect(api_access_id,api_secret_key,api_default_org,api_base_url)# define the ID of the task we would like to retrievetask_id=123456# create a tasks objecttasks=tc.tasks()# set a filter to retrieve the task with the id: 123456filter1=tasks.add_filter()filter1.add_id(task_id)try:# retrieve the Taskstasks.retrieve()exceptRuntimeErrorase:print('Error: {0}'.format(e))sys.exit(1)# iterate through the Tasksfortaskintasks:print(task.name)# remove the 'Test' tag from the tasktask.delete_tag('Test')# commit the task with the removed tag to ThreatConnecttask.commit()

Note

In the prior example, no API calls are made until the commit() method is invoked.